CVE-2026-93105

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the esp ssg unref() function where it incorrectly releases page references on the source scatterlist after an AEAD operation. When a socket buffer (skb) contains managed fragments (SKBFL MANAGED FRAG REFS), which are owned by a zerocopy user buffer, the skb does not hold a per-frag page reference. Because esp ssg unref() lacks the necessary skb zcopy managed() guard, it may drop a page reference that was never acquired. This can lead to a page reference count underflow, potentially freeing a page that is still in use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.